5 ms·
Funnily enough, Germany has laws for where you are allowed to store backups exactly due to these kinda issues. Fire, flood, earthquake, tornadoes, whatever you
by zwnow 1y ago
Funnily enough, Germany has laws for where you are allowed to store backups exactly due to these kinda issues. Fire, flood, earthquake, tornadoes, whatever you name, backups need to be stored with appropriate security in mind.
- egorfine 1y agoGermany, of course. Like my company needs government permission to store backups.
- leipert 1y agoMore like: your company (or government agency) is critical infrastructure or of a certain size, so there are obligations on how you maintain your records. It’s not like the US or other countries don’t have similar requirements.
- egorfine 1y ago[flagged]
- leipert 1y agoNope: The other way around. If you are of a certain size, you are required to ensure certain criteria. NIS-2 is the EU directive and it more or less maps to ISO27001 which includes risk management against physical catastrophes. https://www.openkritis.de/eu/eu-nis-2-germany.html https://www.openkritis.de/eu/eu-nis-2-germany.html Of course you can do backups if you are smaller, or comply with such a standard if you so wish.
- egorfine 1y ago[flagged]
- mschuster91 1y agoWell, given that way too many companies in the critical infrastructure sector don't give a fuck about how to keep their systems up and we have been facing a hybrid war from Russia for the last few years that is expected to escalate in a full on NATO hot war in a few years, yes it absolutely does make sense for the government to force such companies to be resilient against Russians. Just because wherever country you are at doesn't have to prepare for a hot war with Russia doesn't mean we don't have to. When the Russians come in and attack, hell even if they "just" attack Poland with tanks and the rest of us with cyber warfare, the last thing we need is power plants, telco infra, traffic infrastructure or hospitals going out of service because their core systems got hit by ransomware.
- egorfine 1y ago> it absolutely does make sense for the government to force such companies Problem is, a) governments are infiltrated by russian assets and b) governments are known to enforce detrimental IT regulations. Germany especially so. > power plants, telco infra, traffic infrastructure or hospitals Their system _will_ get hit by ransomware or APTs. It is not possible to mandate common sense or proper IT practices, no matter how strict the law. See the recent incident in South Korea with burned down data center with no backups.
- deleted 1y ago[deleted]
- hiharryhere 1y agoGovernment isn’t perfect but I’d be interested to know what alternative you propose?
- egorfine 1y agoa) Incarceration time for IT execs and responsible engineers. b) Let companies go out of business once they fail to protect their own crucial data. None of that is possible.
- flumpcakes 1y agoIt feels like you are being obtuse/arguing in bad faith. Of course there are standards on backups. Most countries have them. Let's think what regulations does the 'free market' bastion US have on computer systems and data storage... HIPAA, PCI DSS, CIS, SOC, FIPS, FINRA...
- zestyping 1y ago> This is incredible. Government telling me how to backup my data. Incredible. No more incredible than the government telling you that you need liability insurance in order to drive a car. Do you think that is justifiable?
- fauigerzigerk 1y agoThe difference is that you cannot choose who you're sharing a road with while you can usually choose your IT service providers. You could, for instance, choose a cheaper provider and make your own backups or simply accept that you could lose your data. Where people have little or no choice (e.g government agencies, telecoms, internet access providers, credit agencies, etc) or where the blast radius is exceptionally wide, I do find it justifiable to mandate safety and security standards.
- johannes1234321 1y agoLosing data is mostly(*) fine if you are a small business. If a major bank loses it's data it is a major problem as it may impact a huge number of customers and an existential way, when all money is "gone" (*) From state's perspective there is still a problem: tax audits, bad if everybody avoids them by "accidental" data loss
- fauigerzigerk 1y agoAs I said, a wide blast radius is a justification and banks are already regulated accordingly. A general obligation to keep financial records exists as well.
- Chris2048 1y ago> you cannot choose who you're sharing a road with while you can usually choose your IT service providers You can choose where to eat, but the gov still carrier out food heath and safety inspections. The reason is that it isn't easy for customers to observe these things otherwise. I think the same applies to corporate data handling & storage.
- Skeime 1y ago(Without knowing the precise nature of these laws) I would expect that they don't forbid you to store backups elsewhere. It's just that they mandate that certain types of data be backed up in sufficiently secure and independent locations. If you want to have an additional backup (or backups of data not covered by the law) in a more convenient location, you still can.
- egorfine 1y ago> sufficiently secure and independent locations This kind of provision requires enforcement and verification. Thus, a tech spec for the backup procedure. Knowing Germany good enough, I'd say that these tech spec would be detrimental for the actual safety of the backup.
- greybeard69 1y agowild speculation and conjecture
- egorfine 1y agoAgree. It is based on my experience with German bureaucracy.
- f1shy 1y agoNot wild. When you live in Germany and are asked to send a FAX (and not a mail, please). Or a digital birth certificate is not accepted until you come with lawyers, or banks not willing to operate with Apple pay, just to name few.. Speculation, yes, but not at all wild
- __bjoernd 1y agoI'm German and in my 45 years of being so have never been required to send a fax. Snail mail yes, but never a fax.
- hdgvhicv 1y agoNo it doesn’t. It does however need to follow the appropiate standards commensurate with your size and criticality. Feel free to exceed them.
- Chris2048 1y agoCertain data records need to be legally retained for certain amounts of time; Other sensitive data (e.g. PII) have security requirements. Why wouldn't government mandate storage requirements given the above?